Cisco Talos observed Lazarus Group activity from February to July 2022 against energy providers in the United States, Canada, Japan and other regions, assessing the campaign as North Korean state-sponsored espionage aimed at long-term access and data theft. Initial access came through exploitation of exposed VMware Horizon servers, including Log4Shell, followed by reverse shells, reconnaissance, Windows Defender impairment, toolkit downloads and lateral movement. The intrusions deployed Lazarus-linked implants VSingle and YamaBot, as well as a newly identified MagicRAT implant, with VSingle used for further reconnaissance, exfiltration and manual backdooring. Talos noted overlaps with earlier AhnLab, CISA, JPCERT/CC and Kaspersky reporting, including shared infrastructure such as 84[.]38.133[.]145 and similar VMware exploitation patterns, underscoring Lazarus’ continued focus on critical infrastructure espionage.